Children's Privacy

Children get extra protection under EU law because they may be less aware of the risks of sharing personal data. If young people can use your website or app, the GDPR and the Digital Services Act set specific rules.

The age of digital consent (GDPR Article 8)

When you offer an online service directly to a child and rely on consent, the child must be at least 16 to consent alone. Member states can lower that age to 13, and many have: the age is 13, 14, 15 or 16 depending on the country. Below it, a parent or guardian must give or authorise consent, and you must make reasonable efforts to verify that, using the technology available.

Article 8 covers consent only. Other legal bases still apply, but the fairness and transparency principles weigh more heavily for children (Recital 38).

Speak their language

Information addressed to a child must be in clear and plain language a child can understand (Article 12). A separate, simple privacy summary for young users is a good way to meet this.

The Digital Services Act and minors

• Online platforms accessible to minors must put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for them (Regulation (EU) 2022/2065, Article 28).
• Platforms must not show advertising based on profiling when they are aware with reasonable certainty that the user is a minor.
• The European Commission's 2025 guidelines on Article 28 recommend private-by-default accounts, limits on features that encourage excessive use, and age assurance proportionate to the risks.

Practical checklist

1. Decide honestly whether children use your service, whatever your terms say.
2. Set an age gate that matches the countries you serve, and a parental consent flow where needed.
3. Use the most protective privacy settings by default for young users.
4. Switch off profiling-based advertising and non-essential tracking for minors.
5. Collect as little as possible: no precise location, no public profiles by default.
6. Make it easy for a parent or child to ask for deletion (see Data Subject Rights).

This guide is general information about EU rules, not legal advice. Requirements can differ by country and by business: check with your data protection authority or a lawyer for your case.